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Field of the invention 

The present llivmiiuii iclulu, Lu packet swiLuliiug, more specifically-to data stream 
~5 — dec o ding mi d data str e am anal ysa 
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Related art 

hrrhe-fi'rld-rtf rinta and compmer^ommi mi r^t ; r> n c there is an increasing need for 
high speed/high bandwim products^ packet switching and 

more specifically to data stream decoding^d-peranenTfeTh^present invention 
4acludes: ~~ 

U.S. 5509006, 
JP 6/276198, 
EP 767565, 
EP 953897, 
US 5594869 

The problem of extracting address inforniationjna^witcl^from a packet in a data 
stream is in the prior art solved by applying masks on the content of one or more 
delay lines to filter out the required information. One disadvantage with this 
approach is the difficulty to adjust the switch to new communication protocols, 
because the masks are hardware implemented. Another disadvantage with the prior 
art is that the data in the delay line is only accessible at a certain position or certain 
positions, instead of being available all the time they reside in the delay line. 

Accordingly, it is an object of the present invention to provide a device for 
imp^o\^pj^grarn mable datastream analysis in the contextof packet switch ing in 
the context_o£this^ocurnent a datastream can be any type of data stream, e.g. a 
-bytewise E foemet datasjeam in a computer network, including an Ethernet packet 
with different combinations of contents. 

Summary of the invention 

lvention relates to a device for data stream analysing. Said device is able to 
recognis>Qi€6?rentdata streams and then start other processors or functionalities to 
store or check datan^iatas^ream. Special features are: a compare processor, a 
compare instruction memory?a*Tfeiaji£eam pipeline, a multiplexer and a multi- 
plexer control unit, making it possible tolestTpacketdata under program control 
using several instructions and under several cldck^cle^even^though said data is 
moving forward in the pipeline and even though other bytesofaltta^s entering the 
device. 
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Brief description of the drawings 

The invention will be described in detail below with reference to the accompanying 
drawings in which 
5 — Fig. 1 is a block diagram of the invention 
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F*§r-24s-a-btaefc-iriag r am of the inultiplcx ercenfrel-mit 
Fig 3 is an interface overview of the invention 



Detailed description nf 



pretegetLembQdiJTients 



^ieTByeattea-i&jgef ^bly implem ented as an integrated circuit (IC) having an 
electrical interface tothe outside. HelnVe n t iOn comprises a num Bero^phylcal or 
legieal-u nits includ ing; 
a delayline 1 
a multiplexer 2 
a multplexer control unit 3 
a compare processor 5 
a compare instruction memory 4 
a save engine 6 
a bit save unit 7 
a save instruction memory 8 
a stream save unit 9 
an address bus 
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When a data stream enters the device of the invention, it is passed through a delay- 
line 1, preferably a 23 shifts deep and 1 byte wide shift register. As long as a byte 
resides in the first 16 positions it can be accessed by the compare processor 5, 
which basically will act as a packet parse r. The compare processor 5 is responsible 
for decodingj^ackets. It is also connected to a compare instruction memory 4 
which inherits the parsing code. 

One characteristic property of the invention is that every incoming byte in the dat a 
Jtream is numbered with atag.^hen the compare_pi^^r5^sMipra_specifir 
.tag t^muljipje^ 

i^toecompare processor 5 have come to some kind of conclusion it might want 
to^^^SS^mj^result^eld or an option field, see below. This is done by 
starting up a saveleZmeace, A start addresser ajgyesequence will be sent from 
thecpmpar^processor-S^o mela^ngine^Said save engine 6 examine the . 
mcommgjddress and decides if it is a save reSrain^&eJ^h^ o r the^tio^) 



• 




According to this decision the address is placed in either a bit save fifo 
registe>6J^ora stream save fifo register 62 respectively. 



three-fttnctions;(Tt can seTBits in the^resuU field, perform 



The bit save unit 7 has 
checksum conQol.aud luu 

The stream save i/nit 9 executes the instruction that saves the option field. Said 
stream save unit 9 also inserts the result field into the stream and regulates a number 
of control signals. 
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edelayline 1 preferably comprises a 23 shifts deep, 1 byte wide shift register, 
first positions of the shift register is reachable from the compare processor 5 
through>tnuhiplexer 2. The two last^ jtjonsarecon nected to the two save units 
7, 9 ( bit save^dj tteam savg. The stream save unit 9 is actually only using the 
very last position/alx^only the bit save unit 7 needs the last two positions because 
the checksum control worles^ 16 bits at a time. There are five positions that are 
prevented from being accessedVtte parsing function of the compare procesor 5 
and by the save units 7, 9 (bit save an^eam save). The. reason for a delay before 
the byte stream arrives to the save units 7>is N that all start addresses sent fro m the, 
compare processor 5 to the sa ve units 7, 9 are queued in a fifo register. Depending 
on how many save sequences in the queue and how lo^g they are, this might in 
some extreme situations generate an error. This is because Njtal data already have 
passed through th e_ddayjinej)^^ is starteriX^- delay 

is the 
(dresses 
:ycles is 



64 



needed to secure that no sucrTerror liccur is 4*64=192 clock cycl _ 
maximum length of a save sequence and 4 is the maximum of start _ 
waiting to be executed. However, calculus have showed that five dela 
e nough, sine? all gave ooqucnccs n o imaHy written are veiy - s hort. 
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characteristic function of the invention is that it automatically keeps track of 
k * ^-byte has its location in the delayline. The programmer only need to 

specify wfijfc^ta^.e. which number the byte has, whe re the first b yte in a packet is 
n umber zero, the^econd is number 1 and so on. This is why every byte arriving to 
the delayline 1 should^a^ged (numbered). The tagging operating could easily be 
done by just ad ding an e xtra fiejdqn ev ery shift in the delayline 1 inheriting the 
byte's tag. But this is disadvantageoi^u^woaspects. First, much silicon would be 
used to implement the extra field in the delayUn^Seoond, when the parser wants 
^ to look at a specific tag it would take a lot of time if eveiylhifthad to be searched 
to find the wanted tag. 
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Lisxead, the present invention has solved the above problem by making a part of the 
deteyline multiplexable; said multiplexable part of the delayline comprises 
preferably the 16 latest mcoming bytes. Worst case for the length of a packet is 1 
b yteWon eous), but since the first 12 bytes always contain the OSI Media Access 

"Controlvad'dress (MAC-address), no usefuTinformation can be extracted if the 

packet is shorter than 13 bytes. These packets will force the compare processor 5 to 
begin with fhe next packet at once and their DV (data valid) signal will be unset so 
the rest of the device or a switch will never see it. With a limit of at least two clock 
cycles (bytes) between different packets it is possible to guarantee that never more 
than two packets exist at the same time in the delayline 1. 



According to the^etoerW standard the IFG (Inter Frame Gap), which means the 
distance between packets^ at least 20 cycles, but a smaller distance is always 
desirable. E.g. a minimum Wance of 6 cycles makes it possible to easy extend the 
device to be able to take care V SONET frames (An alternative ISO-OSI Layer 2 
frame instead of ethemet). 
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The multiplex control unit 3 uses tw^denticaLTa£LM^ (TU), one for_each 

P° s s*l£P|Eket^a Controlling StatemSwnliuCS ) to control the TU:s 32. 33 and 
a TU muliplexer 34 to choose which oneV the TU:s 32, 33 that the compare 
processor 5 is interested in. One TU includes a tagfield register 321, and a lastfield 
register 322, some adders and a simple staterriachine 323: The other TU 33 is 
identical. Whe^pjicjket_arj^ 321 starts to increment for 

everybyte. When the DV signal becomes Sslag^in the tagfield register 321 stops 
counting an d the la stfleldr egister 322 starts to increV pt. The TU 32 sends an 
'end_of LpackeTsig^aT^e^ejas tfie^d registerl2TrXach.es the numbj rof shift. m 

_t he delaylin e 1 . If the packet waTsho^er than 13 bytes a\oo_short'lig^al^iirb; 

generated! ' \ 

30 The position of a re^siedbyje is located according to the expression 
P - tagfield + l astfiridj^ wanted_tag 

In the above expression "p" is the position of the wanted byte in the delayline- 

35 '^gfjeld" is_the value..of.me.tagfield.r.egi^(321 or 33 1); "lastfield" is the vahie of 

^15516^5^(3^2.0032) and "wanted_tag" is the posinon~offce~w^ied 
bytej^tivej:^e_^ 
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A TU 32, 33 also generates a , tag_error" signal if the requested tag never will be 
available or tag_soon' if the requested tag has not arrived to the delayline yet. 

The controlling statemacbine (CS) 31 is responsible for s electing a free TU (32 or 
5— 33-)Hfcr-an-amving-paekefran^ 



packets are available. The CS 3 1 will unselect a TU (32, 33) when the TU generates 
an 'end_ofj5ackef signal. An unselected TU (32, 33) will be reset to prepare it to 
receive the next incoming packet. The CS 31 is also controlling the TU multiplexer 
34 to change its state every time the compare processor is asking for a new packet. 



feature of the device according to the present invention is that the compare 

^compare instruction memory 4 together act as a programmable 
parser. The descriptionoToie-&lUnsttuction set of said parser is not part of this 
document, but some instruction type7a7e~meJrtic«edJ2elo^^e parser uses four 
registers 51, 52, 54, 55 to fulfil it's tasks. " 

• One PC register 55 thatholds the value of the program counter. 

• One general register 52. It can be used with instructions for arithmetic 
operations and for 'IFJTHENJELSE' operations. 

• One base register 54. When the p arser ^arches_ajag,jhej^hjejn t he bas e 
register54 is added to t he searched" tag valu e. This is usedtobTable to reuse 
instruction code for e.g. OSI Layer 3 frames, even if they are encapsulated in 
different OSI Layer 2 frames. 

• One stack address register 5 1 used to store addresses when subroutines are 
called with 'JUMP_SUB ROUTINE' type instructions. Accordingly, 'RETURN' 
type instructions copy the stack back to the PC 55. 

^Instructions are executed in one clockcycle, except in two cases. This is possible 
beca^^hecompare processor unit receives two instructions every clockcycle from 
the compare in^taictaonmemory 4 which is of the double ported memory type. This 
features decreases weto^miount of clock cycles needed for the compare 
processor 5 to parse a packet, there^eCTeasing the needed size of the delayline. 
Some instructions are able to start saveTe^nei^d instructions have a field that 
tells what address in the save instruction memory 8uwrshallstart the execution. 
Save address 0x00 will not generate a start of a save sequence. 

The compare processor 5 must know when a new parsing is started so the registers 
51, 52, 54, 55 can be reset. Therefore, when parsing of apacket is done, there shall 
be a 'jump_and_save' instruction with jump adress 0x7f (=last compare instruction 



memory 4 address). When this is detected it resets and starts looking for a new 
packet. If the compare processor 5 gets the signal too_shorf it is reset. Turther a 
tag_soon' signal pauses the processor 5 and a tag_error' signal forces it to be-in 
with the next packet. ° 



save engine 6 takes the address sent from the compare processor 5 and 
detern^fciiis^e start address of a bit save sequence or a byte stream sequence 
After this the adcgesTteg^erwith thecung ^lae of the basejregister 54 i s put in 
the specific fifo 61, 62. The v^-ef^hebase register 54 is needed for all save 
10 instructions that is using tag numbers. W^e^e^device according to the invention 
programmed, a constant is written to the save engine^ttrtell where bit save 
sequences ends in the save instruction memory 8. This featurTexist^ecause it is 
hard to tell how many instructions are needed to the different parts anditlTmors 
expensive to map two memories than one twice as big. 
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The bit. save unit 7 writes to the result field 76. The result field 76 preferably 
consists of 24 bits or 3 bytes. It is controlled by the save instruction memory 8 and 
orders other units to execute the instructions. The executing units are: 

Checksum 

■■ checksum unit 73 executes the a checksum control instruction which performs 
a 1 fivbitone complement addition. The unit needs to know what tag to start the 
executionfrom (Tag) and how many bytes the checksum should cover (Length) If 
there are cfie^ksum errors (i.e. the sum differs from OxFFFF) the unit writes to the 
result field 76. further, this block need the value of the base register 54 as it was 
when the compare >^ce SS or 5 sent the start address of the current save sequence. 

Bit 

The bit unit 74 executes bit sav^mmand which bitwise W-ise one selected byte 
m me result field 76 with the data fk^ m other words, all bits which are set in the 
data field will invert the corresponding bit in the result field 76. It is only possible 
to invert one specific bit one time per pack^this is because e.g. an OSI Layer 3 
error could be found in many ways, but if the b>which indicate a Layer 3 error is 

7^7°^ ° f WOUW l0 ° k ^ a ^? rt La ^ 3 P a *et in the 

Z£ r u I* fidd ^ t0 Which ° ne ° f *~ * 

result field 76 to write to. 



Length error 
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^length error unit 75 is the most complex unit and investigates lengths in a 
packet^nd is used with one or more length control instructions. In a network there 
might odburpackets that has been cut of. This causes many sorts of errors, e.g. if 
layer 4 is shd*terthan two bytes the result field 76 should indicate Layer 3 error but 
5— B©t*Ay«^-«Kff>^e!e^^ 

and one controller. A^heckbox needs to know at which tag to start the measurement 
from, what kind of comparison* is supposed to perform (more.less, equal or not 
equal) and what length to matches comparison to. If a checkbox detects a length 
error, a field which is part of the instruction tells to which one of four possible bits 
in the results field 76 to write to. As with ^checksum unit 73, this unit 75 also 
needs the value from the base register 54 as it w^hen the compare processor 5 
sent the start address of the current save sequence. 

The stream save executing unit 9 has only one save instruction to handle, a byte 
stream save instruction. Said instruction is used to save to the option field and 
includes a start tag number, a length and an six bit wide address to tell were inthe 
option field t he selected bytes are to be written . Besides of this it also inserts the 
result field 76 as soon as all bit save instructions are executed. 

Interface 

ielertrical interface of a preferred embodiment of the invention to the outside 
world^de^cribed in conjunction with fig. 3. It includes an input interface and an 
output mterfa£e>q3 i einput interface of the invention includes nine input terminals 
for a synchronous, eig^bi^wide, serial data stream, and a data valid (DV) signal 
both used by the data that sh^uTd^decoded. The input interface also includes a ' 
programming interface that comprise^S^it address bus, an 18-bit data bus a 
chip select and a write enable signal for progTa^gi foe two instruction. These 28 
mput terminals are used to program the invention afteTpbwer on. 
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The output interface includes output terminals for a serial byte stream^Sgether with 
some control signals. The control signals include a data valid (1 bit), an option field 
address (6 bits), a store and a halt signal (1 bit each). The store signal tells if the 
current byte is to be stored in an option field, the halt signal together with the store 
signal tells if the stream out is the inserted result field. The address bus allows 
addressing in the option field. 




^pHcation for the present invention is for packet switching in a computer 
network togeTrieT^ith^ackets^ by extracting information, especially 
addresses, from the packet he^TblEca^^ ^ several 
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*ruct 10 ns and under several clock cycles even though said data is moving forward 
m tfrs4elayhjie (1) and even though other bytes of data is entering the device. One 
of the feanlres^rfthe invention is that the decoding of the protocol is programmable 
This is a major advawa^ebecause new or different types of protocols can be 
5-haadled-by-ju^^ wi „ be nQ negd f ^ ^^ thg 

hardware. This could save time andn^neyfor companies responsible for providing, 
maintaining and updating network switches/"" 



